Non-Human Identities: The New IAM Problem
Service accounts, API keys, OAuth apps, workload identities and now AI agents vastly outnumber employees in most organisations, and they are…
Research
Security, software & AI research
Threat reports, engineering deep-dives and practical guidance on cybersecurity, software engineering and AI from the EthicalHat team.
CybersecuritySoftware EngineeringAI & LLMsAI SecurityAI-Assisted EngineeringApplication SecuritySecure AI Engineering
BreachCIS ControlsCIS CSATCloud SecurityCyber AttacksGeneralIncident ResponseMicros RetailNetwork SecurityPhishingSANSSecurity Operations CenterSecurity PatchesSecurity ThreatsSOC
MCP Security: The New Security Boundary for AI Applications
MCP has become the standard way AI applications reach enterprise systems, and that makes the MCP layer a security boundary in its own right,…
The Agentic Attack Surface: Identity, Tools, Memory and Autonomous Actions
A tester's view of agentic systems. We break the agent attack surface into four areas (identity, tools, memory and autonomy), describe the a…
Agentic Software Engineering: When AI Agents Become Software Developers
In many engineering organisations, agents now open a steady share of pull requests. That raises management questions nobody had to answer be…
The AI-Native Security Architecture: Agents, MCP, Identity, Runtime and Observability
Organisations running many AI agents need more than per-agent controls. They need a security architecture: shared identity for agents, a gov…
The Agentic Attack Surface: Securing Autonomous AI Systems
A year ago, most AI agents were pilots. Now they run inside ticketing systems, CI pipelines, SOCs and customer service, often with more acce…
Agentic AI Architecture: Building AI Systems That Can Actually Act
Moving from AI that answers to AI that acts changes the architecture. Actions need identity, authorisation, state, reliability and accountab…
Agentic Software Engineering: Can AI Build and Maintain Software?
Coding agents can now complete many well-defined tasks end to end. The harder question for 2026 is whether they can maintain software over t…
Agentic DevSecOps: When AI Agents Can Write, Test and Deploy Code
Agents now take part in every stage of the delivery pipeline: writing features, fixing findings, triaging failures and preparing releases. T…
AI Red Teaming for Developers: Testing Agents Before Production
Red teaming used to be something a security team did to a finished system. For AI agents, it has to start with the developers who build them…
AI Agents in CI/CD: Can Agents Test, Debug and Deploy Software?
Coding agents now run inside CI pipelines: triaging failed builds, fixing flaky tests, reviewing pull requests and responding to issues. The…
AI-Powered Cyberattacks: How Attackers Are Automating Reconnaissance and Exploitation
For two years, 'AI-powered attacks' mostly meant better phishing emails. This summer, public reports showed criminals using agentic AI tools…